Getting Data In

running permissions for splunk user of forwarder on linux and solaris

Communicator

Hi

I have some universal forwaders installed on linux (suse) and solaris.

I have a user "splunk" to log to those machines and make restart to the forwarder service if necessary.

However, if I do that with splunk user, the forwarder stops sending data to my Indexer. If however I do that with a root user, the forwarder starts sending data again to Indexer.

What are the permissions a user needs to controls the splunk forwarder service in a *nix machine??

(this doesnt help - http://docs.splunk.com/Documentation/Splunk/4.3/installation/RunSplunkasadifferentornon-rootuser)

Thank you

0 Karma
1 Solution

Communicator

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

View solution in original post

0 Karma

Communicator

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

View solution in original post

0 Karma

Path Finder

Can you please guide how you assigned the permissions to log file. I used chmod to assign the read permissions but it is not working. When the file get rolled over the permissions were not carried so forwarder stops sending the data.

0 Karma